CVE-2023-53647

A NULL pointer dereference flaw was found in the Linux kernel's Hyper-V VMBus driver in the ACPI resource walking logic. A local user can trigger this issue on systems running under hypervisors that do not provide Hyper-V MMIO ranges in the VMBus ACPI device hierarchy, causing the driver to walk up to the ACPI root object and attempt to dereference its all-ones handle. This results in a NULL pointer dereference in the ACPI subsystem, leading to a kernel crash and denial of service during boot.

The VMBus driver walks the ACPI namespace from the VMBus device upward searching for Hyper-V MMIO resource ranges. When these ranges are not found in the device or its ancestors, the code continues walking until it reaches the ACPI namespace root object, which has a special all-ones handle value. Attempting to use this handle causes the ACPI code to dereference a NULL pointer (from adding an offset to NULL). This occurs with VMBus implementations that don't provide these MMIO ranges, such as QEMU's VMBus emulation. The ranges appear to be optional since Windows guests function without them. The crash occurs during boot when the VMBus driver probes, affecting Linux guests under KVM/QEMU when using Hyper-V paravirtualization interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the hv_vmbus module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.